Vulnerability intelligence
CVE-2026-26980
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
CVSS Score
9.4
Critical
EPSS — Exploit Probability
5.6%
Riskier than 93% of all CVEs · checked 2026-10-24
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
7 articles across 5 outlets · first covered May 25, 2026 · latest Oct 7, 2026
Associated threat actors
Coverage timeline
RSS-
Anthropic expands Claude access for vetted cybersecurity researchersthehackernews.com · Oct 7, 2026
-
Ghost CMS mass hack via CVE-2026-26980 fuels ClickFix attack wavesecurityaffairs.com · May 31, 2026
-
Global Ghost CMS Poisoning Campaign Exploits Enterprise Blogssecurityonline.info · May 27, 2026
-
Hackers Hijack 700+ Sites via Ghost CMS SQLi Flaw CVE-2026-26980www.malwarebytes.com · May 26, 2026
-
Ghost CMS SQL flaw lets attackers hijack 700+ sites, steal keyssecurityaffairs.com · May 25, 2026
-
Ghost CMS CVE-2026-26980 SQLi Triggers Attack on 700 Siteswww.securityweek.com · May 25, 2026
-
CVE-2026-26980 flaw hijacks 700+ Ghost sites for click fraudthehackernews.com · May 25, 2026